nostr-mcp
nostr-mcp
一个用于安全探索 Nostr 的只读 Model Context Protocol 服务器。它为代理提供语义化工具,用于解析 Nostr 标识符、读取个人资料和事件、查询笔记以及检查中继元数据。
此首个版本刻意不接受私钥或发布事件。签名将通过远程签名器(如 NIP-46)添加,并带有明确的用户批准边界。
工具
工具 | 用途 |
| 解码十六进制、 |
| 获取某个公钥最新的有效 kind |
| 通过十六进制 ID、 |
| 使用有界过滤器查询已验证的 kind |
| 获取并规范化中继的 NIP-11 信息文档 |
每个返回的事件都包含提供它的中继。无效签名会被丢弃,重复事件会被合并,部分中继故障会被报告而不是隐藏。
Related MCP server: nostr-read-mcp
要求
Node.js 20.19 或更高版本
支持 stdio 服务器的 MCP 主机
为 Codex 安装
使用一条命令安装并注册服务器:
npx -y @diegoyegros/nostr-mcp install验证注册:
npx -y @diegoyegros/nostr-mcp doctor
codex mcp list安装程序会将此 stdio 命令存储在 Codex 中:
npx -y @diegoyegros/nostr-mcp@latest使用以下命令移除注册:
npx -y @diegoyegros/nostr-mcp uninstall作为 Codex 插件安装
该仓库也是一个 Codex 插件市场,包含 MCP 服务器和一个捆绑的 Nostr 技能:
codex plugin marketplace add DiegoYegros/nostr-mcp --ref master打开 Codex,运行 /plugins,选择 Nostr Plugins,然后安装 Nostr MCP。该插件是只读的,并添加了用于解析标识符、查询公共笔记、检查事件以及报告中继来源的指南。
直接 MCP 安装程序和插件安装是两种可选方案。安装插件后即可获得其捆绑的 MCP 服务器。
与任何 MCP 客户端一起运行
npm 包发布后,任何兼容 stdio 的 MCP 主机都可以使用以下命令启动它:
npx -y @diegoyegros/nostr-mcp@latest示例 MCP 客户端配置:
{
"mcpServers": {
"nostr": {
"command": "npx",
"args": ["-y", "@diegoyegros/nostr-mcp@latest"],
"env": {
"NOSTR_RELAYS": "wss://relay.damus.io,wss://nos.lol"
}
}
}
}从源码运行
npm install
npm run build
node dist/index.js使用 Codex 注册源码检出:
codex mcp add nostr -- "$(command -v node)" "$PWD/dist/index.js"配置
变量 | 默认值 | 含义 |
|
| 逗号分隔的默认中继 URL |
|
| 每次查询的超时时间,限制在 500-30000 毫秒 |
|
| 每次工具调用最多使用的中继数,限制在 1-20 |
默认只接受公共 wss:// 中继 URL。包含凭据、片段、回环主机或私网 IP 地址的 URL 将被拒绝。
当工具调用提供 relay_urls 时,仅查询这些中继。否则,在尝试配置的默认值之前,会先尝试来自 NIP-19 标识符的安全中继提示。
开发
npm run check检查包括类型检查、54 个单元测试和集成测试、现代 MCP stdio 协商冒烟测试、安装程序 CLI、插件元数据一致性以及 npm 包内容。中继测试使用假中继和签名固定数据,因此它们是确定性的,不依赖于公共中继的可用性。
在不发布的情况下预览 npm 工件:
npm pack --dry-run发布
npm 名称是 @diegoyegros/nostr-mcp。可以使用以下命令手动发布首个版本:
npm login
npm publish --access public包含的 prepublishOnly 钩子会在发布前运行完整的验证套件。后续版本可以通过在配置仓库的 NPM_TOKEN 密钥后创建 GitHub release 来自动化。发布工作流会使用 npm 来源证明发布包。
安全模型
只读 MCP 工具注解
不接受
nsec或原始私钥输入在事件到达代理之前进行签名验证
严格的中继 URL 验证以降低 SSRF 风险
有界的中继数量、结果大小和超时时间
查询结果中的中继来源和每个中继的错误
有关报告和信任边界的详细信息,请参阅 SECURITY.md。
许可证
MIT
Available Tools
5 toolsnostr_get_eventGet Nostr eventARead-onlyIdempotent
Fetch one signature-verified Nostr event by hex ID, note, or nevent and report which relays supplied it.
| Name | Required | Description | Default |
|---|---|---|---|
| event | Yes | ||
| relay_urls | No | Optional relay URLs to query instead of identifier hints and configured defaults |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, so the description is not required to repeat safety. It adds valuable context: signature verification and relay reporting, which go beyond annotations. No contradiction found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that immediately conveys the core purpose and key behaviors. No unnecessary words; it is front-loaded and easily parsed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only fetch with two parameters, the description covers purpose, verification, and relay reporting. It lacks explicit mention of return format or error behavior, but annotations and schema (relay_urls description) fill most gaps. It is sufficiently complete for the tool's low complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides no description for 'event', but the tool description compensates by explaining accepted formats (hex ID, note, nevent). The 'relay_urls' parameter already has a schema description, and the description reinforces 'instead of identifier hints and configured defaults'. This coverage is adequate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it fetches a single signature-verified Nostr event, specifying accepted ID formats (hex, note, nevent) and the relay reporting behavior. This distinguishes it from siblings like nostr_query_notes (multiple events) and nostr_get_profile (profile-specific).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving a single event by its identifier, but does not explicitly contrast with sibling tools or state when not to use it. The scope (one event vs. querying many) is evident, yet no explicit exclusions or alternatives are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_get_profileGet Nostr profileARead-onlyIdempotent
Fetch the newest signature-verified, valid JSON kind 0 profile for an npub, nprofile, or hex pubkey.
| Name | Required | Description | Default |
|---|---|---|---|
| identity | Yes | ||
| relay_urls | No | Optional relay URLs to query instead of identifier hints and configured defaults |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint false, so the description doesn't need to repeat safety traits. It adds context by specifying 'signature-verified' and 'valid JSON kind 0', implying data quality guarantees and potential filtering behavior. It does not mention network behavior, timeouts, or fallback logic, but the annotation coverage is strong, so this is acceptable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, front-loaded with the key purpose and constraints. It is concise and has no filler words, earning its place with specific technical details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has simple parameters, no output schema, and strong annotations, the description offers sufficient context for correct selection and invocation. It lacks a list of possible output fields, but that might be okay for a profile fetch; however, it could mention that it returns a parsed profile object. Still, the description is adequate for a straightforward read operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The identity parameter is not described in the schema, but the description clarifies it accepts npub, nprofile, or hex pubkey. The relay_urls parameter is partially described in the schema as 'Optional relay URLs to query instead of identifier hints and configured defaults', which matches the description's intent. The description adds meaning for the key parameter, compensating for the 50% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool fetches the newest signature-verified, valid JSON kind 0 profile for an npub, nprofile, or hex pubkey. It specifies the verb (fetch), the resource (Nostr profile), and the exact scope (newest, signature-verified, valid JSON kind 0), which distinguishes it from sibling tools like nostr_get_event or nostr_query_notes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used when you need a user's profile data, and the parameter 'relay_urls' suggests optional customization. However, it does not explicitly state when to use this tool versus alternatives like nostr_resolve_identity or nostr_get_event, nor does it provide exclusions or alternative recommendations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_inspect_relayInspect Nostr relayARead-onlyIdempotent
Fetch a relay's NIP-11 information document without following redirects. Only public wss:// relay URLs are accepted.
| Name | Required | Description | Default |
|---|---|---|---|
| relay_url | Yes | ||
| timeout_ms | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the tool as read-only, idempotent, and non-destructive. The description adds meaningful behavioral details: it does not follow redirects and only accepts public wss:// URLs. This goes beyond the annotations and clarifies potential edge cases, though it doesn't explain what happens on redirects or invalid URLs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences that front-load the main action (fetch) and immediately state the key constraints. Every word earns its place with no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and the core purpose is clear. However, with no output schema and no parameter descriptions, the description leaves a gap around the timeout_ms parameter and does not describe what the returned NIP-11 document might contain. Given the tool's narrow scope, it is adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema lists two parameters (relay_url and timeout_ms) with no descriptions (0% schema description coverage). The description does not explain either parameter, leaving timeout_ms entirely unexplained. The meaning of relay_url is inferable from the tool's purpose, but the timeout behavior is undocumented, so the description fails to compensate for the schema gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (fetch) and the resource (relay's NIP-11 information document). It also adds specific constraints (doesn't follow redirects, only public wss:// URLs). This distinctly separates it from sibling tools like nostr_get_profile or nostr_query_notes, which handle different resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use the tool (fetching relay metadata) and includes a strict input requirement (public wss://). It does not explicitly mention alternatives, but the sibling tools have obviously different purposes, so the usage context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_query_notesQuery Nostr notesARead-onlyIdempotent
Query signature-verified kind 1 notes with bounded author, time, text-search, event-reference, and pubkey-mention filters.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| since | No | ||
| until | No | ||
| search | No | ||
| authors | No | ||
| relay_urls | No | Optional relay URLs to query instead of identifier hints and configured defaults | |
| mentioned_pubkey | No | ||
| referenced_event | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide idempotentHint, readOnlyHint, etc., but the description adds the important behavioral detail that results are 'signature-verified', which is not in annotations. It also mentions 'bounded' filters, implying limits. This adds value beyond the structured fields, though it doesn't cover pagination or relay behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, dense sentence that front-loads the core purpose and adds key context (signature-verified) without fluff. Every word contributes value, and it is easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 8 parameters, no output schema, and low schema coverage, the description is too thin. It doesn't explain how filters combine (AND/OR), output ordering, pagination, default limit, or what 'signature-verified' entails operationally (e.g., rejection of unverified events). The description fails to provide enough operational detail for an agent to correctly invoke the tool with proper parameter values and expectations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 13% (only relay_urls has a description). The description lists filter categories (author, time, text-search, event-reference, pubkey-mention) that map to several parameters, giving high-level meaning. However, it doesn't explain parameter formats (e.g., pubkey hex, UNIX timestamps) or constraints like limit defaults. It partially compensates for low schema coverage but leaves gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it queries 'signature-verified kind 1 notes' with specific filter types, which is a precise verb+resource combination. It distinguishes from siblings like nostr_get_event (single event) and nostr_resolve_identity (identity resolution) by focusing on filtered queries over kind 1 notes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for querying/filtering notes, and the filter list makes it clear this is the go-to tool for searching notes. However, it doesn't explicitly name alternatives or state when not to use it, though the sibling tools naturally cover other cases (single event, profiles, relays).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_resolve_identityResolve Nostr identityARead-onlyIdempotent
Decode a hex, npub, nprofile, note, nevent, or naddr identifier. nsec and encrypted private-key identifiers are rejected.
| Name | Required | Description | Default |
|---|---|---|---|
| expected | No | auto | |
| identifier | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false, establishing the safety profile. The description adds valuable behavioral context beyond these annotations by explicitly rejecting nsec and encrypted private-key identifiers, which is not inferable from the annotations or schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, front-loaded with the verb and subject, and contains no redundant information. Every clause adds value: accepted formats and rejected formats.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and annotations are strong, but the description does not explain the 'expected' parameter or describe the output shape. Since there is no output schema, the agent is left without a clear picture of what the resolution returns (e.g., a pubkey, event id, or type indicator), making the description incomplete for smooth invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It partially covers 'identifier' by listing valid formats, but it completely ignores the 'expected' parameter and its enum values (auto, pubkey, event). The meaning of 'expected' and its effect on decoding is left unexplained, leaving the agent uncertain about a key input.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Decode' and enumerates exactly which identifier formats are accepted (hex, npub, nprofile, note, nevent, naddr), clearly distinguishing this from sibling tools that fetch profiles, events, or query notes. It also states what is rejected (nsec, encrypted keys), further sharpening the tool's purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The context makes it clear this tool is for decoding identifiers before fetching related data, and the listed sibling tools (get_profile, get_event) imply an alternative workflow. However, there is no explicit 'when to use' or 'when not to use' comparison, only the implicit separation of concerns via the description and sibling names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.1.0- First observed
nostr_get_event - First observed
nostr_get_profile - First observed
nostr_inspect_relay - First observed
nostr_query_notes - First observed
nostr_resolve_identity
TDQS
Scored across 5 tools
Each tool targets a distinct Nostr operation: identifier resolution, profile fetch, specific event fetch, note querying, and relay inspection. No two tools overlap in purpose; boundaries are clear.
All tools use the consistent prefix 'nostr_' followed by a verb_noun pattern (resolve_identity, get_profile, get_event, query_notes, inspect_relay). Perfectly uniform and predictable.
With 5 tools, the server is well-scoped for a read-oriented Nostr client. Each tool provides a distinct capability without redundancy, fitting the typical 3-15 range ideal.
The surface covers core read operations: identity decoding, profiles, single events, filtered note queries, and relay metadata. Missing publishing and multi-event/list fetching, but these are minor gaps for a query-focused server.
Maintenance
Related MCP Connectors
Public read-only MCP server for HODLXXI agent identity, trust, receipts, and verification.
Read-only MCP server for The Quiet Protocol's engines, benchmarks, proof, and business data.
Read-only MCP gateway. Paid verify is $0.01 USDC on Base.
21Read-only MCP server: let AI agents read your ORANO saved-video library, tasks, and memory.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceTrust-aware Nostr MCP server. 236 tools for identity, social, DMs, trust scoring, AI-to-AI dispatch, Lightning payments, privacy proofs, and encrypted vaults. NIP-46 bunker auth; keys never leave the signing device.437 npm1MIT
- AlicenseNot gradedqualityDmaintenanceA read-only MCP server for AI agents to access Nostr profiles, notes, search, and relay lists through user-chosen relays, without requiring an account or keys.MIT
- AlicenseAqualityBmaintenanceRead-only MCP server for discovering and ranking on-chain agents on Stellar mainnet via natural language search, reputation probes, and profile lookups.1331 npm1MIT
- AlicenseNot gradedqualityBmaintenanceRead-only MCP server for the Dant3 social network, exposing public feeds, rooms, agents, jobs, and platform stats to AI agents with no write capabilities.1MIT No Attribution